Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SBOM and Omnitrail Attestor #464

Merged
merged 5 commits into from
Jun 13, 2024
Merged

SBOM and Omnitrail Attestor #464

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c58ffe4
Add new docs and schema for new SBOM attestor. Also includes schema u…
jkjell Jun 10, 2024
0c15286
Update docs and fix multiple signatures
jkjell Jun 12, 2024
616eab9
Update to go-witness v0.5.0 and support testing on Darwin/Mac (no tra…
jkjell Jun 13, 2024
584b3ff
Add testing and policy for SBOM attestations
jkjell Jun 13, 2024
55d15ab
Update to go-witness v0.5.1
jkjell Jun 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion cmd/run.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,6 @@ func runRun(ctx context.Context, ro options.RunOptions, args []string, signers .
witness.RunWithAttestors(attestors),
witness.RunWithAttestationOpts(attestation.WithWorkingDir(ro.WorkingDir), attestation.WithHashes(roHashes)),
witness.RunWithTimestampers(timestampers...),
witness.RunWithSigners(signers...),
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ha, we were calling this twice?

)
if err != nil {
return err
Expand Down
4 changes: 3 additions & 1 deletion docs/attestors/git.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,9 @@
"$ref": "#/$defs/Tag"
},
"type": "array"
},
"branch": {
"type": "string"
}
},
"additionalProperties": false,
Expand Down Expand Up @@ -129,4 +132,3 @@
}
}
}

3 changes: 3 additions & 0 deletions docs/attestors/git.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,9 @@ The attestor returns the SHA1 ([Secure Hash Algorithm 1](https://en.wikipedia.or
"$ref": "#/$defs/Tag"
},
"type": "array"
},
"branch": {
"type": "string"
}
},
"additionalProperties": false,
Expand Down
145 changes: 145 additions & 0 deletions docs/attestors/omnitrail.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,145 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$ref": "#/$defs/Attestor",
"$defs": {
"Attestor": {
"properties": {
"Envelope": {
"$ref": "#/$defs/Envelope"
}
},
"additionalProperties": false,
"type": "object",
"required": [
"Envelope"
]
},
"Element": {
"properties": {
"type": {
"type": "string"
},
"sha1": {
"type": "string"
},
"sha256": {
"type": "string"
},
"gitoid:sha1": {
"type": "string"
},
"gitoid:sha256": {
"type": "string"
},
"posix": {
"$ref": "#/$defs/Posix"
}
},
"additionalProperties": false,
"type": "object",
"required": [
"type"
]
},
"Envelope": {
"properties": {
"header": {
"$ref": "#/$defs/Header"
},
"mapping": {
"additionalProperties": {
"$ref": "#/$defs/Element"
},
"type": "object"
}
},
"additionalProperties": false,
"type": "object",
"required": [
"header",
"mapping"
]
},
"Feature": {
"properties": {
"algorithms": {
"items": {
"type": "string"
},
"type": "array"
}
},
"additionalProperties": false,
"type": "object"
},
"Header": {
"properties": {
"features": {
"additionalProperties": {
"$ref": "#/$defs/Feature"
},
"type": "object"
}
},
"additionalProperties": false,
"type": "object",
"required": [
"features"
]
},
"Posix": {
"properties": {
"atime": {
"type": "string"
},
"ctime": {
"type": "string"
},
"creation_time": {
"type": "string"
},
"extended_attributes": {
"type": "string"
},
"file_device_id": {
"type": "string"
},
"file_flags": {
"type": "string"
},
"file_inode": {
"type": "string"
},
"file_system_id": {
"type": "string"
},
"file_type": {
"type": "string"
},
"hard_link_count": {
"type": "string"
},
"mtime": {
"type": "string"
},
"metadata_ctime": {
"type": "string"
},
"owner_gid": {
"type": "string"
},
"owner_uid": {
"type": "string"
},
"permissions": {
"type": "string"
},
"size": {
"type": "string"
}
},
"additionalProperties": false,
"type": "object"
}
}
}
148 changes: 148 additions & 0 deletions docs/attestors/omnitrail.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,148 @@
## Schema
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to have docs for this new attestor. @fkautz maybe you have a couple mins to add this?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Filed #465 to not block this PR.

```json
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$ref": "#/$defs/Attestor",
"$defs": {
"Attestor": {
"properties": {
"Envelope": {
"$ref": "#/$defs/Envelope"
}
},
"additionalProperties": false,
"type": "object",
"required": [
"Envelope"
]
},
"Element": {
"properties": {
"type": {
"type": "string"
},
"sha1": {
"type": "string"
},
"sha256": {
"type": "string"
},
"gitoid:sha1": {
"type": "string"
},
"gitoid:sha256": {
"type": "string"
},
"posix": {
"$ref": "#/$defs/Posix"
}
},
"additionalProperties": false,
"type": "object",
"required": [
"type"
]
},
"Envelope": {
"properties": {
"header": {
"$ref": "#/$defs/Header"
},
"mapping": {
"additionalProperties": {
"$ref": "#/$defs/Element"
},
"type": "object"
}
},
"additionalProperties": false,
"type": "object",
"required": [
"header",
"mapping"
]
},
"Feature": {
"properties": {
"algorithms": {
"items": {
"type": "string"
},
"type": "array"
}
},
"additionalProperties": false,
"type": "object"
},
"Header": {
"properties": {
"features": {
"additionalProperties": {
"$ref": "#/$defs/Feature"
},
"type": "object"
}
},
"additionalProperties": false,
"type": "object",
"required": [
"features"
]
},
"Posix": {
"properties": {
"atime": {
"type": "string"
},
"ctime": {
"type": "string"
},
"creation_time": {
"type": "string"
},
"extended_attributes": {
"type": "string"
},
"file_device_id": {
"type": "string"
},
"file_flags": {
"type": "string"
},
"file_inode": {
"type": "string"
},
"file_system_id": {
"type": "string"
},
"file_type": {
"type": "string"
},
"hard_link_count": {
"type": "string"
},
"mtime": {
"type": "string"
},
"metadata_ctime": {
"type": "string"
},
"owner_gid": {
"type": "string"
},
"owner_uid": {
"type": "string"
},
"permissions": {
"type": "string"
},
"size": {
"type": "string"
}
},
"additionalProperties": false,
"type": "object"
}
}
}
```
17 changes: 17 additions & 0 deletions docs/attestors/sbom.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://github.com/in-toto/go-witness/attestation/sbom/sbom-attestor",
"$ref": "#/$defs/SBOMAttestor",
"$defs": {
"SBOMAttestor": {
"properties": {
"SBOMDocument": true
},
"additionalProperties": false,
"type": "object",
"required": [
"SBOMDocument"
]
}
}
}
24 changes: 24 additions & 0 deletions docs/attestors/sbom.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# SBOM Attestor

The SBOM attestor records the contents of any [products](./product.md) that are valid [CycloneDX](https://cyclonedx.org/specification/overview/) or [SPDX](https://spdx.dev/learn/overview/) json files. The SBOM file is parsed and the contents are recorded in the attestation.

## Schema
```json
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://github.com/in-toto/go-witness/attestation/sbom/sbom-attestor",
"$ref": "#/$defs/SBOMAttestor",
"$defs": {
"SBOMAttestor": {
"properties": {
"SBOMDocument": true
},
"additionalProperties": false,
"type": "object",
"required": [
"SBOMDocument"
]
}
}
}
```
1 change: 1 addition & 0 deletions docs/commands.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ witness run [cmd] [flags]
--attestor-maven-pom-path string The path to the Project Object Model (POM) XML file used for task being attested (default "pom.xml"). (default "pom.xml")
--attestor-product-exclude-glob string Pattern to use when recording products. Files that match this pattern will be excluded as subjects on the attestation.
--attestor-product-include-glob string Pattern to use when recording products. Files that match this pattern will be included as subjects on the attestation. (default "*")
--attestor-sbom-export Export the SBOM predicate in its own attestation
--attestor-slsa-export Export the SLSA provenance predicate in its own attestation
--enable-archivista Use Archivista to store or retrieve attestations
--hashes strings Hashes selected for digest calculation. Defaults to SHA256 (default [sha256])
Expand Down
Loading
Loading